0

Using Nexus 5 with AospExtended ROM (Android 9) 19/04/05

The ROM, by default, has the SELinux policy set to Permissive instead of Enforcing.

Is there any way, perhaps using TWRP Recovery, to change the SELinux policy to Enforcing? perhaps a similar Android 9 ROM

Some apps such as Google Pay will not work if the phone is rooted or the SELinux policy is not set to Enforcing. Also, feel slight safer if the NSA SELinux security policy was enforced.

Advice appreciated

Improve this question
1
  • SELinux is set Enforcing by init during boot process on user builds of a ROM. If you are on eng or userdebug build, you need to set SELinux enforcing manually. You can use an init.d script or directly create an init service (.rc) file for the purpose. Make sure you have a working SELinux policy file before setting Enforcing. Related: android.stackexchange.com/a/209374/218526
    – Irfan Latif
    Apr 25, 2019 at 22:05

1 Answer 1

Reset to default
2

If a custom ROM has SEL set to enforcing, it means the dev is confident that features are working under strict SEL, and you can safely change it to permissive knowing that things will continue to work under a more lax SEL environment.

On the other hand, however, if he chooses to release with SEL permissive (especially if he lists it in the "bugs" section), it means some critical features doesn't work yet under strict SEL, forcing the dev to use permissive for the time being. Under this circumstance you shall not change it to enforcing.

Regarding Google Pay, it's common practice to just use Magisk and let it hide root/BL/SEL status for you instead.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .